# PhishDestroy domain threat record: proton.hk.cn Content language: English Canonical HTML report: https://phishdestroy.io/domain/proton.hk.cn/ Machine-readable companion: https://phishdestroy.io/domain/proton.hk.cn/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 02:11:37 UTC - Last availability or vendor check: 2026-10-23 10:35:49 UTC - Stored record updated: 2026-10-23 18:22:22 UTC - VirusTotal detections in the stored snapshot: 4/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: celer ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: Web Commerce Communications Limited - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-07-18 22:31:30 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16685-672b-724a-88fc-584dfce831ad/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/proton.hk.cn - Certificate Transparency search: https://crt.sh/?q=%25.proton.hk.cn - Web Archive lookup: https://web.archive.org/web/*/https://proton.hk.cn/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s automated intake flagged proton.hk.cn because VirusTotal reported a malicious detection for the domain. The AI assessment identified the site as an impersonation of ProtonVPN, noting that the official domain is protonvpn.com while the recorded page title reads “ProtonVPN - 极致安全的瑞士隐私保护 VPN | 官方网站”. The domain was first seen by PhishDestroy on 2026-10-23 and returned an HTTP 200 response on that date. How the scam works Brand‑impersonation phishing creates a replica of a legitimate service’s branding and wording to trick users into disclosing credentials, installing software, or making payments. Attackers host the counterfeit page on a look‑alike domain and rely on the trusted brand’s reputation to harvest information or funds. Evidence VirusTotal scanned the domain on 2026-10-19 and recorded four detections, including one malicious label from CRDF and three suspicious labels from Fortinet, Gridinsoft and alphaMountain.ai. Google Safe Browsing did not flag the site on 2026-10-23. Spamhaus DBL listed the domain as phishing on 2026-10-23, and OTX showed four related pulses on the same day. External blocklists MetaMask and SEAL contained the domain, and urlscan.io returned a malicious verdict with a score of 100, categorising it as phishing and associating it with the Protonmail brand. PhishDestroy’s internal list also marks the domain as malicious. Infrastructure The recorded IP address is 188.114.96.3, belonging to Cloudflare, Inc., with the recorded country listed as Canada. The TLS certificate observed on 2026-10-23 was issued by Google Trust Services, is valid from 2026-09-16 to 2026-12-15, and covers proton.hk.cn and its subdomains. The domain is 96 days old, uses Cloudflare’s WAF, and DNSSEC was not enabled. What to do Visitors should avoid entering any ProtonVPN credentials or payment information on this site; if they have already done so, they should change the affected passwords immediately. Defenders should block the domain proton.hk.cn at the network perimeter and monitor for outbound connections to the recorded Cloudflare IPs. Continue to follow updates from PhishDestroy and other threat feeds for any changes in the site’s behavior. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16685-672b-724a-88fc-584dfce831ad/ Cloudflare Radar report: https://radar.cloudflare.com/scan/8e26633f-1e9b-49bd-8673-3de152487438 URLQuery report: https://urlquery.net/report/395bd1dc-2e57-4bd5-8fba-f4196af4a3df Stored capture screenshot: https://i.ibb.co/fdrpWLVM/91ea0b7942ca.png Cloudflare Radar screenshot (2026-10-23T02:53:02Z): https://screenshots.phishdestroy.io/cf/8e26633f-1e9b-49bd-8673-3de152487438.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/395bd1dc-2e57-4bd5-8fba-f4196af4a3df.png URLScan screenshot (2026-10-23T02:15:33Z): https://screenshots.phishdestroy.io/us/01a1668a-a428-7247-85c1-40407a8b7ab9.png URLScan capture report: https://urlscan.io/result/01a1668a-a428-7247-85c1-40407a8b7ab9/ URLScan screenshot (2026-10-23T02:16:04Z): https://screenshots.phishdestroy.io/us/01a1668b-2708-7260-b6d3-277f81460a09.png URLScan capture report: https://urlscan.io/result/01a1668b-2708-7260-b6d3-277f81460a09/ VirusTotal report: https://www.virustotal.com/gui/domain/proton.hk.cn Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=proton.hk.cn Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 02:55:53 UTC ## Stored page captures - Primary capture: https://i.ibb.co/fdrpWLVM/91ea0b7942ca.png Captured: 2026-10-23 02:11:37 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a16685-672b-724a-88fc-584dfce831ad.png Captured: 2026-10-23 02:11:37 UTC Source report: https://urlscan.io/result/01a16685-672b-724a-88fc-584dfce831ad/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8e26633f-1e9b-49bd-8673-3de152487438.png Captured: 2026-10-23 02:53:02 UTC Source report: https://radar.cloudflare.com/scan/8e26633f-1e9b-49bd-8673-3de152487438 SHA-256: 7797a39785481aa0c5e1f3835145fe0876a4148e6160283e4e7ac5403e92ee30 - URLQuery: https://screenshots.phishdestroy.io/uq/395bd1dc-2e57-4bd5-8fba-f4196af4a3df.png Source report: https://urlquery.net/report/395bd1dc-2e57-4bd5-8fba-f4196af4a3df SHA-256: 16aa4b9737894cbda141462cac5c9dbc8d829cde80071d839e4ce9a57bf83351 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a1668a-a428-7247-85c1-40407a8b7ab9.png Captured: 2026-10-23 02:15:33 UTC Source report: https://urlscan.io/result/01a1668a-a428-7247-85c1-40407a8b7ab9/ SHA-256: a3fc50f8f15a473b3ab09312ca5f67e61380a45e0618fd19ed25d96bdd04f1e7 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a1668b-2708-7260-b6d3-277f81460a09.png Captured: 2026-10-23 02:16:04 UTC Source report: https://urlscan.io/result/01a1668b-2708-7260-b6d3-277f81460a09/ SHA-256: a3fc50f8f15a473b3ab09312ca5f67e61380a45e0618fd19ed25d96bdd04f1e7 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T02:54:24Z", "uuid": "01a16685-672b-724a-88fc-584dfce831ad", "scanned_at": "2026-10-23T02:09:46Z", "final_url": "https://proton.hk.cn/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://proton.hk.cn/", "from": "http://proton.hk.cn/", "status": 307 } ], "ip": "188.114.96.3", "domains": [ "protonhk.matomo.cloud", "cdn.matomo.cloud", "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "18.157.122.248", "65.8.131.32", "142.251.20.94", "142.251.20.95", "188.114.96.3" ], "asns": [ "16509", "15169", "13335" ], "countries": [ "DE", "US" ], "link_domains": [ "protonvpn.com" ], "doc_hash": "476995891205a659439d7e05eb0e9e311b66a2bc1b724e328b7b3399e7743411", "script_hashes": [ "176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15", "3e7501d15c3630e791c8b20392eb9dee31a9f65ce3efdde76cef5c710141ab24", "1c25cdc615d6fb67abd73ef1145128abeeb3414b1088f90987c53400c660cb26", "60ca862ce335c5cbd8dce1316bde7dc62db5fadfa8b5cb63a4cc16f54f176e9e", "27b765bdb4a516a7b386255aceb8d27b1a68187f6225cf7eb83ec84c568c2233" ], "globals": [ "tailwind", "/template.html", "$", "jQuery", "generateUniqueId", "makeid", "loadScript", "onDownload", "desktop", "android", "ios", "webapp", "downloadLink", "androidDownloadLink", "iosDownloadLink", "webappDownloadLink", "_paq", "Piwik", "Matomo", "matomoAbTestingCampaignUrlParamList", "AnalyticsTracker", "piwik_log", "timestamp", "script" ], "cookies": [ "_pk_id.1.f171", "_pk_ses.1.f171" ], "tls": { "san": [ "proton.hk.cn", "www.proton.hk.cn", "*.www.proton.hk.cn" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "proton.hk.cn", "protocol": "TLS 1.3", "valid_to": "2026-12-15T12:32:01Z", "valid_from": "2026-09-16T11:32:11Z" }, "domain_age_days": 96, "apex_age_days": 96, "tls_age_days": 36, "tls_valid_days": 90, "requests": 13, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 85, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "protonmail" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Protonmail" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T02:54:26Z", "uuid": "8e26633f-1e9b-49bd-8673-3de152487438", "scanned_at": "2026-10-23T02:53:02Z", "final_url": "https://proton.hk.cn/", "status": 200, "history": [ { "url": "https://proton.hk.cn/", "status": 200 } ], "dom_hash": "f38eaadfa737ded89bd29c79fdc1389f51fc8b330a83e65cc457042355ba2f97", "doc_hash": "3481150e587621cc6740143e73c93b494baa3489517538a183cf5778f32d1caf", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "proton.hk.cn", "type": "A", "value": "188.114.97.3" }, { "name": "proton.hk.cn", "type": "A", "value": "188.114.96.3" }, { "name": "proton.hk.cn", "type": "AAAA", "value": "2a06:98c1:3120::3" }, { "name": "proton.hk.cn", "type": "AAAA", "value": "2a06:98c1:3121::3" } ], "dnssec_valid": false, "ip": "188.114.97.3", "whois": { "registrar": "Web Commerce Communications Limited", "created": "2026-07-19T00:31:30Z", "expires": "2027-07-19T00:31:30Z", "nameservers": [ "jacqueline.ns.cloudflare.com", "dave.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T02:52:12Z", "analysis_at": "2026-10-19T19:27:10Z", "stats": { "timeout": 0, "harmless": 51, "malicious": 1, "suspicious": 3, "undetected": 37 }, "detections": { "CRDF": "malicious", "Fortinet": "spam", "Gridinsoft": "suspicious", "alphaMountain.ai": "suspicious" }, "reputation": 0, "created": "2026-07-19T00:00:00Z", "first_seen": "2026-07-18T22:05:33Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.21.34.65" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::6815:2241" }, { "ttl": 21600, "type": "NS", "value": "dave.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "jacqueline.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "dave.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.199.77" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::ac43:c74d" } ], "dns_at": "2026-10-19T19:27:27Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "proton.hk.cn", "www.proton.hk.cn", "*.www.proton.hk.cn" ], "issuer": "Google Trust Services / WE1", "serial": "97b978e7a73f897d130a1a94c05c9a09", "sha256": "e279e3ff65dd6e6a498d4b63444f6171be690508c0ae5549453f80e74c27fb69", "subject": "proton.hk.cn", "valid_to": "2026-12-15T12:32:01Z", "valid_from": "2026-09-16T11:32:11Z" }, "whois": [] }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T02:54:40Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "proton.hk.cn" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-23T02:14:13Z", "first": "2026-10-23T02:14:13Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 9962 }, "social_tags": { "ogUrl": "https://proton.hk.cn/", "title": "ProtonVPN - 极致安全的瑞士隐私保护 VPN | 官方网站", "ogType": "website", "robots": "index, follow", "ogImage": "https://proton.hk.cn/images/logo.svg", "ogTitle": "ProtonVPN - 极致安全的瑞士隐私保护 VPN", "keywords": "ProtonVPN, VPN, 隐私保护, 网络安全, 翻墙, 瑞士VPN, 无日志VPN, 高速VPN", "description": "ProtonVPN 提供高速、可靠且极致安全的 VPN 服务。由 CERN 科学家创立，受瑞士隐私法保护，严格执行无日志政策，助您安心畅游互联网，突破网络审查。", "canonicalUrl": "https://proton.hk.cn/", "ogDescription": "ProtonVPN 提供高速、可靠且极致安全的 VPN 服务。由 CERN 科学家创立，受瑞士隐私法保护，严格执行无日志政策，助您安心畅游互联网。" }, "trackers": { "requests": 11, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Matomo", "company": "Matomo", "country": "NZ", "category": "Site Analytics", "requests": 2 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 10, "tls": 26, "wait": 49, "connect": 20, "download": 8 }, "response_ms": 113 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 39461, "co2_grams": 0.0014, "cleaner_than": 42 }, "dns_server": { "ns": [ { "ip": "162.159.38.132", "host": "jacqueline.ns.cloudflare.com" }, { "ip": "108.162.193.109", "host": "dave.ns.cloudflare.com" } ], "zone": "proton.hk.cn" }, "cookies": { "cookies": [ { "name": "_pk_id.1.f171", "same_site": "Lax" }, { "name": "_pk_ses.1.f171", "same_site": "Lax" } ] }, "location": { "ip": "2a06:98c1:3120::9", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "proton.hk.cn" }, "dns": { "A": [ "188.114.97.9", "188.114.96.9" ], "NS": [ "dave.ns.cloudflare.com", "jacqueline.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"dave.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415201264, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::9", "2a06:98c1:3120::9" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::9", "family": 6 }, "redirects": { "chain": [ "https://proton.hk.cn" ] }, "linked_pages": { "internal_count": 6 }, "whois": { "registrar": "Web Commerce Communications Limited", "created": "2026-07-18T22:31:30Z", "expires": "2027-07-18T22:31:30Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "jacqueline.ns.cloudflare.com", "dave.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html" } } } } ```